gt-oai 886d9377d3 Cache cloud requirements (#11305) ...

We're loading these from the web on every startup. This puts them in a
local file with a 1hr TTL.

We sign the downloaded requirements with a key compiled into the Codex
CLI to prevent unsophisticated tampering (determined circumvention is
outside of our threat model: after all, one could just compile Codex
without any of these checks).

If any of the following are true, we ignore the local cache and re-fetch
from Cloud:
* The signature is invalid for the payload (== requirements, sign time,
ttl, user identity)
* The identity does not match the auth'd user's identity
* The TTL has expired
* We cannot parse requirements.toml from the payload

886d9377d3 · 2026-02-11 14:06:41 +00:00

History

..

src

Cache cloud requirements (#11305)

2026-02-11 14:06:41 +00:00

BUILD.bazel

Fetch Requirements from cloud (#10167)

2026-01-30 12:03:29 +00:00

Cargo.toml

Cache cloud requirements (#11305)

2026-02-11 14:06:41 +00:00